Rules / GL063

GL063 `chmod 777` or world-writable permissions in CI script

Severity: warn
OWASP: CICD-SEC-7 – Insecure System Configuration
CWE: CWE-732 – Incorrect Permission Assignment for Critical Resource

Risk

Setting world-writable permissions (chmod 777, chmod a+w, chmod o+w) on files or directories in a CI script is a security smell. On shared runners where multiple jobs may run on the same host — or where artifacts are accessible to other pipelines — world-writable paths can be modified by other processes. For executables or scripts that are subsequently run in the same job, this creates a TOCTOU (time-of-check/time-of-use) race where a malicious write could replace the file between the chmod and the execution.

The most common legitimate use — making a script executable — only requires +x, not 777.

Trigger example

build:
  script:
    - chmod 777 deploy.sh
    - ./deploy.sh

Flagged forms: octal modes whose "others" digit has the write bit (777, 666, 707, 1777, …), and symbolic clauses granting write to others/all (a+w, o+w, a+rwx). chmod -R 777 on a directory tree is especially concerning.

What is not flagged

chmod +x / chmod 755 — execute permission without world-write
chmod 644, chmod 600, chmod 700 — restrictive modes
chmod u+w, chmod g+w — user/group write (not others)

Safe alternative

build:
  script:
    - chmod +x deploy.sh   # executable only
    - ./deploy.sh

Notes

Severity is warn.
Only the chmod mode argument is analysed, so an unrelated octal-looking number elsewhere on the line (e.g. --port 7777) does not trigger a false positive.
Script-line rule; assumes POSIX shell (see the README Shell assumptions note).
Suppress per-file with .glsec-ignore or inline # glsec:ignore GL063.

Documentation for glsec 1.23.0. Source of this page · Rule implementation

GL063 chmod 777 or world-writable permissions in CI script